CODEWITHSUNDEEP
androidencryptionandroid-ndkkeychainandroid-jetpack-security
Ahmad Shahwaiz
Ahmad Shahwaiz

Reputation: 1512

In Android, How to secure api keys on client side even when device is rooted?

How do we secure api keys on rooted device?

As you know we cant trust the client what we can do is make things difficult for the hacker. Following are some of the points which I know to secure keys

  1. Using NDK (store key in your C class and get it in kotlin class on runtime) - Even if device is rooted or decompiled hacker can't access it.
  2. Using Android Key Chain (stores key in the hardware device and without device integrity, certificate, no one can access it. It is stored in a separate place from your application. Not sure what happens if we decompile the app).
  3. Secure Shared Preference. (Even if we encrypt the file, it can still be access on rooted device, one might can figure the decrypt algorithm after check the code)
  4. Secure Shared Preference and Proguard/ Dexguard? (Still not a good idea to store the encrypted key publicly available under app package when device is rooted.)
  5. If we just encrypt the file? (again it will be under app package folder, can be accessed.)

What can be other options?

Upvotes: 0

Views: 1369

Answers (1)

tyczj
tyczj

Reputation: 74066

Have a look at the Jetpack Security Library where you can encrypt files or shared preferences.

However a good rule of thumb is if you dont want things from your app to be accessed then you should not store them locally

Upvotes: 0

Related Questions